Trellis: Privilege Separation for Multi-user Applications Made Easy